TERESEC Security Briefing Special Edition flyer: Patch, the black cat mascot, holds a tablet reading ISM UPDATE beside six plain-English tiles on the September 2026 Information Security Manual changes: AI agent identity, app consent, remote access tools, credentials, caller checks and six-monthly reviews

Four times a year the Australian Signals Directorate (ASD) updates the Information Security Manual (ISM), its cyber security framework: the standard Australian government agencies follow, and the most complete public description of what "secure" means in this country. The September 2026 release, version 2026.09.4, is a structural one, and most of it is about identity.

No law requires a private small business to follow the ISM. It is still worth ten minutes, because each release says where security expectations are heading, and because six of the 44 new controls describe things a small business, or the IT provider that looks after it, can check this quarter. Those six follow a short summary. Every new control, in ASD's own words, is listed at the end.

#What changed in the ISM in September 2026?

ASD added 44 new controls, amended 105 and withdrew two, and gathered the sign-in, credential and session controls that were spread across system hardening and personnel security into a new chapter, Guidelines for system access. The new controls treat applications, workloads and AI agents as identities in their own right: AI agents get their own identity and register, staff can no longer approve third-party apps, remote access tools go on an allow-list, and applications stop sharing fixed passwords. Essential Eight maturity markings are unchanged.

#What should a small business check this quarter?

1. Your AI agents now need their own ID

What ASD now says. An AI agent, meaning software that acts on your behalf (reading mail, filing documents, placing orders) rather than only answering questions, gets its own identity, distinct from any person's account and from other agents (ISM-2133). It goes in a register that records its owner and purpose, the identities and credentials it uses, and the tools, permissions and data it can reach (ISM-2134, ISM-2135). Agentic applications are held to the minimum tools and permissions (ISM-2156), content they fetch from outside is treated as untrusted (ISM-2158), and what they do is logged (ISM-2159).

Does it affect a small business? If an AI assistant has been connected to your email, files, calendar or accounting software, yes. That is an agent, whatever the product calls it.

One action. Write the list: every agent or assistant with access to business systems, who owns it, and what it can reach. If nobody can write that list, that is the finding.

2. App consent is admin-only

What ASD now says. Staff can no longer grant a third-party application access to the organisation's accounts themselves; an authorised administrator does it (ISM-2137). Those consents are reviewed at least every six months, with unused applications and excessive permissions revoked (ISM-2138), and the "device code" sign-in flow is switched off unless it is needed (ISM-2140). The mechanism is OAuth, the "sign in with your work account" prompt that lets one application act inside another.

Does it affect a small business? Any business on Microsoft 365 or Google Workspace. An application a staff member approved with one click keeps its access after that person's password changes, which is why the approval belongs with an administrator.

One action. In your tenant's admin settings, turn off user consent for third-party applications, then review what has already been granted.

3. Remote access tools go on an allow-list

What ASD now says. Keep a list of the remote monitoring and management (RMM) and remote access tools you actually use, enforce it (ISM-2149), and block every other one at the gateway (ISM-2150). A service provider's access is limited to the tools, source addresses and time windows you approved (ISM-2124) and logged somewhere the provider cannot edit (ISM-2125).

Does it affect a small business? Every business with an IT provider. Your provider's remote tool is legitimate; a second one nobody approved is how intruders stay comfortable.

One action. Ask your provider which remote tools they use and from where, write it down, and block the rest.

4. Passwords in scripts are out

What ASD now says. Applications and services use short-lived, dynamically issued credentials in preference to fixed ones (ISM-2141). Fixed credentials are kept in a central secrets manager (ISM-2142), are unique to each application and environment (ISM-2143), are changed the moment they leak or are found stored in the clear (ISM-2144), and are revoked when no longer needed (ISM-2146).

Does it affect a small business? Any business whose systems talk to each other: a website and a payment gateway, a backup job, a line-of-business application and its database.

One action. Find the passwords and keys your systems use among themselves. Any one that is shared, or lives in a script, needs an owner and a home.

5. Verify the caller before you change anything

What ASD now says. Before acting on a request to change account details, change banking details or make a payment, staff positively identify the requester through a method agreed in advance or a separate trusted channel (ISM-2126). ASD files this under synthetic impersonation: voices and video can now be faked convincingly, and lookalike emails always could be.

Does it affect a small business? Every business that pays invoices or changes supplier details.

One action. Agree a call-back rule, a known number and never the one in the email or the message, and write it into the payments procedure.

6. Six months is the new annual

What ASD now says. Several amended controls move from once a year to every six months: penetration tests and vulnerability assessments, reviews of high-privilege permissions, and rotation of the Kerberos service-account credentials underneath a Windows domain.

Does it affect a small business? The review of who holds administrator rights applies to everyone; the rest applies if you run your own Windows domain or commission testing.

One action. Put both dates in the calendar now, six months apart.

#What else changed in the September 2026 ISM?

The remaining new controls are mostly for the people who run infrastructure, and are worth passing to your IT provider: sign-in tokens bound to the device they were issued to, and sessions revoked when credentials are reset or a device falls out of compliance; immutable backups on infrastructure segregated from production, with its own administrator sign-in; network management interfaces reachable only from a separate management network, with device firmware verified against a known-good baseline; threat hunting at least quarterly; software built reproducibly with pinned dependencies; driver signature enforcement and limits on kernel-mode code; and hardening and logging for Microsoft Active Directory Certificate Services.

Of the 105 amended controls, most were reworded to distinguish human users from non-human ones, the AI agents and service accounts the new chapter is about. Two controls are withdrawn: one rescinded, one merged into its neighbour. Both are listed at the end.

#Did the Essential Eight change?

ASD's Essential Eight maturity markings did not move in this release. If your business measures itself against Maturity Level One, ASD's recommendation for small business, nothing here changes that position. Our Essential Eight page explains the maturity levels and what an assessment involves.

Updated 15 October 2026: ASD has since launched ASD Essentials, the evolution of the Essential Eight. Both frameworks are maintained during the transition; what changed.

#Where can I see these controls in a real report?

Our sample report, generated from our live catalogue for a typical small-business stack, lists every ISM control it counts by identifier, so you can go straight to a line: ISM-2126 on verifying the caller, ISM-2137 on application consent, ISM-2149 on remote tools, ISM-2133 on agent identity. "Reached" and "not reached" there describe the sample stack, not yours.

To see which of these your own licences already reach, run the free coverage check: about three minutes, no sign-up to start (how the check works). Our control mapping was reviewed against every one of the 151 changes within days of the release, so the check reads your selection against ISM 2026.09.4.

Somebody had to read all 151 changes and work out which ones a business actually has to do something about. Every line above is ASD-public fact, so use it: paste it into your newsletter, read it out in a client meeting, lift a paragraph for a board pack. The flyer is the same six changes on one page; the price is our logo in the corner.

#Which 44 controls are new?

ASD's wording, unedited, with ASD's chapter and section names. A control the sample report counts links to its line there.

Procurement and outsourcing (2)

Personnel security (1)

System hardening (6)

System access (16)

System management (4)

Security assurance (1)

Software development (6)

Networking (8)

#Which controls were withdrawn?

#Sources

ISM content © Commonwealth of Australia, CC BY 4.0, via cyber.gov.au.